voice-guard-v2

Prompt-injection classifier for transcribed voice-agent turns: English, the nine Indic languages above in their own scripts, the same languages typed in Latin (Hinglish, Tanglish, ...), and English written in Devanagari.

• Base: speedsharma/dhvaniguard-v0 @ 7821d88 (MuRIL BERT, MIT). MuRIL itself is Apache-2.0.
• Labels: 0 SAFE, 1 INJECTION. Block when P(INJECTION) >= 0.85.
• config.json sets "scores_indic": true. agent-worker reads it to send Indic-script turns to this model instead of skipping them.

Use in agent-worker

HF_TOKEN=<read token> hf download bumbee69/voice-guard-v2

Agent config: features.security.voice_guard.model_path: "bumbee69/voice-guard-v2", and translate_guard.enabled: false. The worker loads with local_files_only, so it must be downloaded on the machine first.

Training

57,035 train / 2,971 val rows, written by gpt-oss-120b and filtered by an LLM judge. Two epochs from the base, best epoch by validation balanced accuracy (FP 0.8%, recall 96.0%). training.json has the full arguments and history.

Held-out test

5,118 rows grown from 1,170 hand-written seeds across 19 language sets, threshold 0.85:

	FP (benign flagged)	recall (attacks flagged)
all	2.0%	97.4%
round 1 (3,879 rows)	1.8%	98.4%
round 2 (1,239 rows)	2.8%	94.3%

Latency p50 12 ms, p95 17 ms, one CPU thread (Apple M5).

Limits

• Training and test text are LLM-written; it has not been measured on real calls.
• Not tested on long tool outputs or documents.
• Weakest on Gujarati and Marathi typed in Latin (recall 88-89%).
• No Odia, Assamese or Urdu.